The npm package 'mnzjgxciwadk' version 1.0.0 contains a single HTML file declared as the package main. This HTML file mimics a Cloudflare Turnstile challenge and, upon user interaction, executes obfuscated JavaScript that redirects the browser to a malicious URL under the *.olive.club domain, forwarding query parameters. There are no lifecycle scripts or JavaScript entry points that execute this code during installation or import, so the malicious behavior only occurs when the HTML file is opened in a browser. This is a case of registry abuse hosting a phishing/redirect landing page inside an npm package, not a supply-chain attack targeting build or runtime environments. One source claims that any computer with this package installed or running should be considered fully compromised, recommending immediate secret/key rotation and package removal, though removal may not eliminate all malicious software.

The impact is primarily on users who open the malicious HTML file in a browser, leading to redirection to a potentially harmful external site. While the package does not execute malicious code during installation or import, the presence of the package on a system is considered by one source to indicate full compromise, implying possible additional undetected malicious activity. Secrets and keys stored on affected systems may be exposed and should be rotated immediately. The package thus poses a phishing and potential system compromise risk.

No official patch or fix is indicated. The recommended mitigation is to remove the 'mnzjgxciwadk' package version 1.0.0 from any system where it is installed. Additionally, all secrets and keys stored on affected systems should be rotated immediately from a different, trusted computer. Since the package does not execute malicious code during installation or import, avoiding opening the HTML file in a browser prevents the redirect. Users should treat any system with this package as potentially fully compromised and perform thorough incident response accordingly.